The Ad Agency Cyber Security Problem

“If you put it in there, it’s in there. If you feed a P&L into ChatGPT or Claude to help you with something, just assume someone else can pull that up.”
— Chris Burcham, CEO & President, Cytek (20:00)

It starts with data — what an agency genuinely needs versus what it gets handed, and why the answer is usually hashes rather than PII. That leads to access: who owns the accounts, what least privilege means when it covers vendors and staff alike, and how a 15-person company ends up with 37 names in its Microsoft admin.

Underneath that sits a cultural problem. Marketing runs at breakneck pace and has to prove ROAS immediately; security runs behind it. Risk isn’t binary, it’s a sliding scale, and MFA is the trade everyone argues about.

Then AI, the fastest-moving piece: if you put it in there, it’s in there. Feed a P&L into ChatGPT and assume someone else can pull it up.

The conversation turns concrete with a breach. A law firm’s DNS was compromised through its administrator account. The site was blue-screened with a message announcing the attackers’ presence, then the email was taken over too. The company refused the ransom and rebuilt on a new domain — and it sent Cytek to audit its own DNS and hosting partners.

The back half is a 15-element control ranking, scored live: offboarding, password managers, shadow IT, retention, AI policy, locked DNS, tag manager access, tested backups, API keys, connected apps, and a joint incident response plan — closing on the tabletop exercises Cytek runs on itself.

Thinking about who has the keys to your marketing stack? Seismic Digital works with clients on exactly this.

In this episode
Ryan Riggin — VP Solutions, Seismic Digital
Brett Suddreth — Co-founder & CEO, Seismic Digital
James Henderson — Co-founder & COO, Seismic Digital
Chris Burcham — CEO & President, Cytek
Erick Anderson — Director of Service Delivery, Cytek

Seismic Digital — digital marketing, Leawood, Kansas

Cytek — cybersecurity, Kansas City Crossroads